root access is available to ec2-user

Products

• CA Identity Suite

Issue/Introduction

The vApp user, ec2-user, can put sudo in front of any command and get access to everything including root shell.  I assume that we should not be able to do this.

For example, we can switch to root user (sudo su -)

 

We suspect it might be something to do with this file:

/etc/sudoers.d/90-cloud-init-users

# User rules for ec2-user

ec2-user ALL=(ALL) NOPASSWD:ALL

Environment

Release : 14.4

Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

Amazon Web Services  image only.

Resolution

The root access for ec2-user is fixed in 14.4 CP2 (14.4.2). There are no backports planned for CP1.